From 8f6f26f7ec5b09afef99a5a9e9cd40c40e792525 Mon Sep 17 00:00:00 2001
From: WaterRain <109326062+CATMIAOZHI@users.noreply.github.com>
Date: Thu, 15 Oct 2026 11:44:48 +0800
Subject: [PATCH] fix(ci): verify the release signature digest across
 build-tools releases

build-tools 37 labels apksigner's signer as `V2 Signer` instead of `Signer #1`, so the release signature check never matched and failed the step without any output. Match the digest at the end of any signer line and print the certificate when it does not match.
---
 .github/workflows/android-build.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/android-build.yml b/.github/workflows/android-build.yml
index d94e5882d3..c2c9f72d94 100644
--- a/.github/workflows/android-build.yml
+++ b/.github/workflows/android-build.yml
@@ -224,7 +224,13 @@ jobs:
             case "$artifact" in
               *.apk)
                 certificate="$("$apksigner" verify --print-certs "$artifact")"
-                grep -Fqi "Signer #1 certificate SHA-256 digest: $expected_apk_digest" <<< "$certificate"
+                # The signer label depends on the build-tools release ("Signer #1" in 35.x,
+                # "V2 Signer" in 37.x), so match the digest at the end of any signer line.
+                if ! grep -Eqi "certificate SHA-256 digest: ${expected_apk_digest}$" <<< "$certificate"; then
+                  echo "Unexpected signing certificate for $artifact" >&2
+                  echo "$certificate" >&2
+                  exit 1
+                fi
                 ;;
               *.aab)
                 jarsigner -verify "$artifact"